OCM-24532 | ci: enable DCO for openshift/rosa

[olucasfreitas]

This PR enables the Prow DCO (Developer Certificate of Origin) plugin for the openshift/rosa repository and whitelists red-hat-konflux as a trusted app so Konflux/Renovate bot PRs are not blocked.

Changes

1. core-services/prow/02_config/openshift/rosa/_pluginconfig.yaml -- adds - dco to the plugins list
2. core-services/prow/02_config/_plugins.yaml -- adds openshift/rosa with red-hat-konflux as a trusted_apps entry under the dco: section

Context

• Jira: OCM-24532
• Related: OCM-23920 -- same change was done for the terraform-redhat repos
• Prior art: openshift/release#78068 -- enabled DCO for terraform-redhat/terraform-provider-rhcs, terraform-redhat/terraform-rhcs-rosa-classic, and terraform-redhat/terraform-rhcs-rosa-hcp
• Reference: Red Hat DCO vs CLA guide

Notes

• Tide label gating (dco-signoff: yes / dco-signoff: no) is intentionally not added to _prowconfig.yaml to avoid blocking openshift-cherrypick-robot PRs, which is a regular GitHub user and cannot be exempted via trusted_apps.
• Contributors will need to use git commit -s to add the Signed-off-by trailer to their commits.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: olucasfreitas
Once this PR has been reviewed and has the lgtm label, please assign deepsm007 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• core-services/prow/02_config/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 79e337db-e67d-477b-8bf6-060d3a6781cf

📥 Commits

Reviewing files that changed from the base of the PR and between 9154d7b and 4143c30.

📒 Files selected for processing (2)

• core-services/prow/02_config/_plugins.yaml
• core-services/prow/02_config/openshift/rosa/_pluginconfig.yaml

---

Walkthrough

Prow plugin configuration for openshift/rosa is updated to enable the DCO plugin with red-hat-konflux configured as a trusted application. Changes span global plugin configuration and repository-specific plugin declarations.

Changes

Enable DCO Plugin for openshift/rosa

Layer / File(s)	Summary
DCO plugin configuration setup core-services/prow/02_config/_plugins.yaml, core-services/prow/02_config/openshift/rosa/_pluginconfig.yaml	Global DCO configuration adds openshift/rosa entry with red-hat-konflux trusted app; repository plugin list updated to include DCO plugin.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested labels

lgtm, jira/valid-reference

Suggested reviewers

• bmeng
• ravitri

🚥 Pre-merge checks | ✅ 12

✅ Passed checks (12 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: enabling the DCO (Developer Certificate of Origin) plugin for the openshift/rosa repository.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR contains no Ginkgo test files or test titles; only Prow configuration YAML files for DCO plugin setup. Check not applicable.
Test Structure And Quality	✅ Passed	The custom check for Ginkgo test code quality is not applicable to this PR, which contains only Prow YAML configuration files (no test code).
Microshift Test Compatibility	✅ Passed	PR adds only Prow plugin configuration (YAML), not Ginkgo e2e tests. MicroShift compatibility check only applies to new e2e tests.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This PR only modifies Prow plugin YAML configuration files. No Ginkgo e2e tests are added or modified, so the SNO test compatibility check does not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only modifies Prow CI configuration files (_plugins.yaml). These are not deployment manifests, operators, or controllers and contain no scheduling constraints (affinity, topology, replicas, etc.).
Ote Binary Stdout Contract	✅ Passed	PR only modifies Prow plugin configuration files (YAML), not OTE binary code or test suite implementations that could violate stdout contracts.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR contains no Ginkgo e2e tests—only Prow plugin configuration YAML files. Check is not applicable.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@olucasfreitas: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

[openshift-ci]

@olucasfreitas: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.